#!/usr/bin/env bash
# Build sites and sync docroots IN PLACE (no dir swap: hostPath mounts bind to
# the directory inode, so replacing the dir would leave pods serving a stale
# path). Routing/TLS are handled by Traefik + cert-manager; no reloads needed.
set -euo pipefail
cd "$(dirname "$0")"
BASE=/home/opc/zai-home-base

echo "==> building site"
python3 build.py

mkdir -p "$BASE/sites/bestdadjokes"
if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce)" = "Enforcing" ]; then
  chcon -Rt container_file_t "$BASE/sites/bestdadjokes" 2>/dev/null || true
fi
rsync -a --delete site/ "$BASE/sites/bestdadjokes/"

echo "==> verifying through Traefik (origin)"
sleep 1
for host in bestdadjokes.lol www.bestdadjokes.lol myadhd.dev; do
  code=$(curl -sk -o /dev/null -w '%{http_code}' --resolve "$host:443:127.0.0.1" "https://$host/" --max-time 10)
  echo "  https://$host -> $code (origin)"
done

echo "==> asset smoke checks"
fail=0
hp=$(curl -sk --resolve bestdadjokes.lol:443:127.0.0.1 https://bestdadjokes.lol/ --max-time 10)
echo "$hp" | grep -q 'rel="stylesheet"' || { echo "  FAIL: stylesheet not linked in homepage"; fail=1; }
for asset in /static/style.css /static/main.js /static/jokes-data.js /static/favicon.svg; do
  out=$(curl -sk -o /dev/null -w '%{http_code} %{content_type}' --resolve bestdadjokes.lol:443:127.0.0.1 "https://bestdadjokes.lol$asset" --max-time 10)
  echo "  $asset -> $out"
  case "$out" in 200*) ;; *) fail=1 ;; esac
done
# every referenced local asset must exist (catches missing files)
echo "$hp" | grep -oE '(src|href)="/[^"]+"' | sed -E 's/(src|href)="([^"]+)"/\2/' | sort -u | while read -r ref; do
  case "$ref" in //*) continue ;; esac
  code=$(curl -sk -o /dev/null -w '%{http_code}' --resolve bestdadjokes.lol:443:127.0.0.1 "https://bestdadjokes.lol$ref" --max-time 10)
  [ "$code" = "200" ] || echo "  WARN: referenced asset $ref -> $code"
done
[ "$fail" = "0" ] || { echo "==> DEPLOY FAILED ASSET CHECKS"; exit 1; }
echo "==> deploy complete"